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DATA PROTECTION ACT 1998 
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


ENFORCEMENT NOTICE 


To: ColourCoat Ltd 


Of: 77 Bohemia Road, St. Leonards-On-Sea, TN37 6RJ 


1. The Information Commissioner (“Commissioner” or “ICO”) has 
decided to issue ColourCoat Ltd (“ColourCoat”) with an enforcement 
notice under section 40 of the Data Protection Act 1998 (“DPA”). t The 
Notice is in relation to a contravention of Regulations 21 and 24 of the 
Privacy and Electronic Communications (EC Directive) Regulations 2003 
(“PECR”). 


2. This notice explains the Commissioner’s decision. 


Legal framework 


3. ColourCoat, whose registered office is given above (Companies House 
Registration Number: 10405998), is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 
contrary to Regulations 21 and 24 of PECR. 


1 The provisions of the Data Protection Act 1998 remain in force for the purposes of 
PECR notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of the 2018 Act). 


1 


1CO. 


Information Commissioner's Office 


Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. Regulation 21 paragraph (1) of PECR provides 
that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 


Under Regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified the 
ICO that they do not wish, for the time being, to receive unsolicited 
calls for direct marketing purposes on those lines. The Telephone 
Preference Service Ltd (“TPS”) is a limited company set up to carry 
out this role. For a fee, it provides businesses who wish to carry out 
direct marketing by telephone a monthly list of numbers on two 
registers: the Telephone Preference Service register (“TPS Register”) 
for individuals’ numbers and the Corporate Telephone Preference 


Service register (“CTPS Register”) for businesses’ numbers. 


In general terms, Regulation 21 paragraph (1)(b) provides that 
companies cannot make unsolicited calls for direct marketing purposes 


to telephone numbers on the TPS Register or CTPS Register, unless the 


Information Commissioner's Office 


individual or business associated with the number has given their 


consent to receive such calls. 
7. Regulation 21 paragraphs (2)-(5) provide: 


“(2) A subscriber shall not permit his line to be used in contravention of 


paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 


(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under Regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 
that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 


any time, and 


(b) where such notification is withdrawn, the caller shall not 
make such calls on that line.” 
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Regulation 21 paragraph (A1) provides that companies making calls for 


direct marketing purposes must not disguise their identity. Paragraph 
(A1) states: 


“A person shall neither use, nor instigate the use of, a public electronic 
communications service for the purposes of making calls (whether 
solicited or unsolicited) for direct marketing purposes except where 
that person— 


(a) does not prevent presentation of the identity of the calling line on 


the called line; or 
(b) presents the identity of a line on which he can be contacted.” 


Regulation 24 of PECR concerns the information which must be 
provided when, inter alia, a business makes marketing calls which 


Regulation 21 applies to. Regulation 24 provides, insofar as relevant: 


“(1) Where a public electronic communications service is used for the 
transmission of a communication for direct marketing purposes 
the person using, or instigating the use of, the service shall 
ensure that the following information is provided with that 


communication - 


(b) in relation to a communication to which regulation 21 
or 21A (telephone calls) applies, the particulars 
mentioned in paragraph (2)(a) and, if the recipient of 
the call so requests, those mentioned in paragraph 


(2)(b). 
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(2) The particulars referred to in paragraph (1) are - 
(a) the name of the person; 


(b) either the address of the person or a telephone 


number on which he can be reached free of charge.” 


Section 122(5) of the Data Protection Act 2018 (“DPA 2018”) defines 
direct marketing as “the communication (by whatever means) of 
advertising or marketing material which is directed to particular 
individuals”. This definition also applies for the purposes of PECR (see 
DPA 2018 Schedule 19, paragraphs 430 and 432(6)). 


Consent is defined in Article 4(11) of the General Data Protection 
Regulation 2016/679 as “any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 


“Individual” is defined in Regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in Regulation 2(1) of PECR as “a person who 
is a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


The DPA contains, at Part V, enforcement powers which are exercisable 
by the Commissioner. Those provisions are modified and extended for 
the purposes of PECR by Schedule 1 PECR. 


Section 40(1)(a) of the DPA (as extended and modified by PECR) 
provides that, if the Commissioner is satisfied that a person has 


contravened or is contravening any of the requirements of the 
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Regulations, she may serve him with an Enforcement Notice requiring 
him to take within such time as may be specified in the Notice, or to 


refrain from taking after such time as may be so specified, such steps 


as are so specified. 


The contravention 


The Commissioner finds that ColourCoat contravened Regulations 21 
and 24 of PECR. 


The Commissioner finds that the contraventions were as follows: 


Between 1 August 2019 to 31 March 2020, ColourCoat used public 
telecommunications services for the purposes of making total of 
969,273 connected unsolicited calls for direct marketing purposes. 
These calls resulted in 24 complaints being made to the TPS and 10 


complaints to the Commissioner. 


ColourCoat made repeat calls to subscribers who had informed 
ColourCoat that they did not wish to receive such calls, in breach of 
Regulation 21(1)(a) of PECR. 


In breach of Regulation 21(1)(b) of PECR, 452,811 of the calls in 
question were to subscribers where the number allocated to the 
subscriber of the called line was a number listed on the TPS or CTPS 
Registers maintained in accordance with Regulation 26 of PECR. The 
Commissioner is satisfied for the purposes of Regulation 21 that these 
452,811 unsolicited direct marketing calls were made to subscribers 
who had registered with the TPS or CTPS at least 28 days prior to 
receiving the calls, and they had not given their prior consent to 


ColourCoat to receive calls. 
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In relation to the 969,273 total connected calls, ColourCoat used 
numbers on which the recipients of the calls could not contact 
ColourCoat. This was done using various presentation Caller Line 
Identities (“CLIs”). ColourCoat also used various false company 
names (including “Homes Advice Bureau”, “EcoSolve UK” and “Citizens 


Advice”) and/or did not identify itself. ColourCoat was therefore in 


breach of: 


a. Regulation 21(A1) of PECR, not to prevent presentation of the 
identity of the calling line on the called line, and to present 


the identity of a line on which it could be contacted; and 


b. Regulation 24(1)(b) of PECR, to provide the recipient of the 
calls with its name and either its address or a telephone 


number on which it could be reached free of charge. 


The Commissioner has considered, as she is required to do under 
section 40 (2) of the DPA (as extended and modified by PECR) when 
deciding whether to serve an Enforcement Notice, whether any 
contravention has caused or is likely to cause any person damage. The 
Commissioner has decided that it is unlikely that damage has been 


caused in this instance. 


In view of the matters referred to above, the Commissioner 


hereby gives notice that, in exercise of her powers under section 40 


of the DPA, she requires ColourCoat to take the steps specified in 


Annex 1 of this Notice. 
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Right of Appeal 


24. There isa right of appeal against this Notice to the First-tier Tribunal 
(Information Rights), part of the General Regulatory Chamber. Information 


about appeals is set out in the attached Annex 2. 


Dated the 16th day of June 2021 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
TERMS OF THE ENFORCEMENT NOTICE 
ColourCoat shall, no later than 30 days after the date of this notice: 


(1) Neither use, nor instigate the use of, a public electronic 
communications service for the purposes of making unsolicited calls 


for direct marketing purposes where the called line is that of: 


(a) a subscriber who has previously notified ColourCoat that such 


calls should not be made on that line; and / or 


(b) a subscriber who has registered their number with either the 
Telephone Preference Service or the Corporate Telephone 
Preference Service at least 28 days previously, and who has not 
notified ColourCoat that they do not object to such calls being 


made. 


(2) Neither use, nor instigate the use of, a public electronic 
communications service for the purposes of making calls (whether 
solicited or unsolicited) for direct marketing purposes except where 


ColourCoat — 


(a) does not prevent presentation of the identity of the calling 


line on the called line; or 


(b) presents the identity of a line on which it can be contacted. 
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(3) where a public electronic communications service is used for the 


transmission of a communication for direct marketing purposes, 


ensure that the recipient of the communication is provided with: 
(a) the name of the person; and if the recipient so requests, 


(b) either the address of the person or a telephone number on 


which he can be reached free of charge. 
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ANNEX 2 


RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


i Section 48 of the Data Protection Act 1998 gives any person upon 
whom an enforcement notice has been served a right of appeal to the 
First-tier Tribunal (Information Rights) (the “Tribunal”) against the 


notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3? You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 


Information Commissioner's Office 


Leicester 
LE1 8DJ 


Telephone: 0203 936 8963 


Email: grc@justice.gov.uk 


e The notice of appeal should be served on the Tribunal within 28 


days of the date on which the enforcement notice was sent 


The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 48 and 49 of, 
and Schedule 6 to, the Data Protection Act 1998, and Tribunal 
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 
2009 (Statutory Instrument 2009 No. 1976 (L.20)). 


